Sleuth Kit Java Bindings (JNI)  4.6.0
Java bindings for using The Sleuth Kit
SleuthkitJNI.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2011-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.io.BufferedReader;
22 import java.io.FileReader;
23 import java.io.IOException;
24 import java.text.DateFormat;
25 import java.text.SimpleDateFormat;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.GregorianCalendar;
29 import java.util.HashMap;
30 import java.util.HashSet;
31 import java.util.List;
32 import java.util.Map;
33 import java.util.Set;
34 import java.util.TimeZone;
35 import java.util.UUID;
37 
46 public class SleuthkitJNI {
47 
48  /*
49  * Loads the SleuthKit libraries.
50  */
51  static {
53  }
54 
59  private SleuthkitJNI() {
60  }
61 
68  private static class HandleCache {
69 
70  /*
71  * A monitor used to guard access to cached Sleuthkit JNI handles.
72  */
73  private static final Object cacheLock = new Object();
74 
75  /*
76  * A SleuthKit image handle cache implemented as a mappng of
77  * concatenated image file paths to image handles.
78  */
79  private static final Map<String, Long> imageHandleCache = new HashMap<String, Long>();
80 
81  /*
82  * A SleuthKit file system handles cache implemented as a mapping of
83  * image handles to image offset and file system handle pairs.
84  */
85  private static final Map<Long, Map<Long, Long>> fsHandleCache = new HashMap<Long, Map<Long, Long>>();
86 
87  /*
88  * The collection of open file handles. We will only allow requests
89  * through to the C code if the file handle exists in this collection.
90  */
91  private static final Set<Long> fileHandleCache = new HashSet<Long>();
92 
93  private static final Map<Long, List<Long>> fileSystemToFileHandles = new HashMap<Long, List<Long>>();
94 
95  private static final String INVALID_FILE_HANDLE = "Invalid file handle."; //NON-NLS
96 
103  private static void addFileHandle(long fileHandle, long fsHandle) {
104  synchronized (cacheLock) {
105  // Add to collection of open file handles.
106  fileHandleCache.add(fileHandle);
107 
108  // Add to map of file system to file handles.
109  if (fileSystemToFileHandles.containsKey(fsHandle)) {
110  fileSystemToFileHandles.get(fsHandle).add(fileHandle);
111  } else {
112  fileSystemToFileHandles.put(fsHandle, new ArrayList<Long>(Arrays.asList(fileHandle)));
113  }
114  }
115  }
116 
117  private static void removeFileHandle(long fileHandle) {
118  synchronized (cacheLock) {
119  // Remove from collection of open file handles.
120  fileHandleCache.remove(fileHandle);
121  }
122  }
123 
124  private static boolean isValidFileHandle(long fileHandle) {
125  synchronized (cacheLock) {
126  return fileHandleCache.contains(fileHandle);
127  }
128  }
129 
130  private static void closeHandlesAndClearCache() throws TskCoreException {
131  synchronized (cacheLock) {
132  /*
133  * Close any cached file system handles.
134  */
135  for (Map<Long, Long> imageToFsMap : fsHandleCache.values()) {
136  for (Long fsHandle : imageToFsMap.values()) {
137  // First close all open file handles for the file system.
138  for (Long fileHandle : fileSystemToFileHandles.get(fsHandle)) {
139  closeFile(fileHandle);
140  }
141  // Then close the file system handle.
142  closeFsNat(fsHandle);
143  }
144  }
145 
146  /*
147  * Close any cached image handles.
148  */
149  for (Long imageHandle : imageHandleCache.values()) {
150  closeImgNat(imageHandle);
151  }
152 
153  fsHandleCache.clear();
154  imageHandleCache.clear();
155  fileHandleCache.clear();
156  fileSystemToFileHandles.clear();
157  }
158 
159  }
160  }
161 
166  public static class CaseDbHandle {
167 
168  /*
169  * A pointer to a TskCaseDb object.
170  */
171  private final long caseDbPointer;
172 
179  private CaseDbHandle(long caseDbPointer) {
180  this.caseDbPointer = caseDbPointer;
181  }
182 
189  void free() throws TskCoreException {
190  HandleCache.closeHandlesAndClearCache();
191  SleuthkitJNI.closeCaseDbNat(caseDbPointer);
192  }
193 
217  long addImageInfo(long deviceObjId, List<String> imageFilePaths, String timeZone) throws TskCoreException {
218  try {
219  long tskAutoDbPointer = initializeAddImgNat(caseDbPointer, timezoneLongToShort(timeZone), false, false, false);
220  runOpenAndAddImgNat(tskAutoDbPointer, UUID.randomUUID().toString(), imageFilePaths.toArray(new String[0]), imageFilePaths.size(), timeZone);
221  return commitAddImgNat(tskAutoDbPointer);
222  } catch (TskDataException ex) {
223  throw new TskCoreException("Error adding image to case database", ex);
224  }
225  }
226 
243  AddImageProcess initAddImageProcess(String timeZone, boolean addUnallocSpace, boolean skipFatFsOrphans, String imageCopyPath) {
244  return new AddImageProcess(timeZone, addUnallocSpace, skipFatFsOrphans, imageCopyPath);
245  }
246 
251  public class AddImageProcess {
252 
253  private final String timeZone;
254  private final boolean addUnallocSpace;
255  private final boolean skipFatFsOrphans;
256  private final String imageWriterPath;
257  private volatile long tskAutoDbPointer;
258  private boolean isCanceled;
259 
273  private AddImageProcess(String timeZone, boolean addUnallocSpace, boolean skipFatFsOrphans, String imageWriterPath) {
274  this.timeZone = timeZone;
275  this.addUnallocSpace = addUnallocSpace;
276  this.skipFatFsOrphans = skipFatFsOrphans;
277  this.imageWriterPath = imageWriterPath;
278  tskAutoDbPointer = 0;
279  this.isCanceled = false;
280  }
281 
299  public void run(String deviceId, String[] imageFilePaths) throws TskCoreException, TskDataException {
300  long imageHandle = 0;
301  synchronized (this) {
302  if (0 != tskAutoDbPointer) {
303  throw new TskCoreException("Add image process already started");
304  }
305  if (!isCanceled) { //with isCanceled being guarded by this it will have the same value everywhere in this synchronized block
306  imageHandle = openImage(imageFilePaths, false);
307  tskAutoDbPointer = initAddImgNat(caseDbPointer, timezoneLongToShort(timeZone), addUnallocSpace, skipFatFsOrphans);
308  }
309  if (0 == tskAutoDbPointer) {
310  throw new TskCoreException("initAddImgNat returned a NULL TskAutoDb pointer");
311  }
312  }
313  if (imageHandle != 0) {
314  runAddImgNat(tskAutoDbPointer, deviceId, imageHandle, timeZone, imageWriterPath);
315  }
316  }
317 
327  public synchronized void stop() throws TskCoreException {
328  isCanceled = true;
329  if (tskAutoDbPointer != 0) {
330  stopAddImgNat(tskAutoDbPointer);
331  }
332  }
333 
341  public synchronized void revert() throws TskCoreException {
342  if (tskAutoDbPointer == 0) {
343  throw new TskCoreException("AddImgProcess::revert: AutoDB pointer is NULL");
344  }
345 
346  revertAddImgNat(tskAutoDbPointer);
347  // the native code deleted the object
348  tskAutoDbPointer = 0;
349  }
350 
360  public synchronized long commit() throws TskCoreException {
361  if (tskAutoDbPointer == 0) {
362  throw new TskCoreException("AddImgProcess::commit: AutoDB pointer is NULL");
363  }
364 
365  long id = commitAddImgNat(tskAutoDbPointer);
366  // the native code deleted the object
367  tskAutoDbPointer = 0;
368  return id;
369  }
370 
377  public synchronized String currentDirectory() {
378  return tskAutoDbPointer == 0 ? "" : getCurDirNat(tskAutoDbPointer); //NON-NLS
379  }
380 
396  @Deprecated
397  public void run(String[] imageFilePaths) throws TskCoreException, TskDataException {
398  run(null, imageFilePaths);
399  }
400  }
401 
402  }
403 
415  static CaseDbHandle newCaseDb(String path) throws TskCoreException {
416  return new CaseDbHandle(newCaseDbNat(path));
417  }
418 
431  static CaseDbHandle newCaseDb(String databaseName, CaseDbConnectionInfo info) throws TskCoreException {
432  return new CaseDbHandle(newCaseDbMultiNat(info.getHost(), info.getPort(), info.getUserName(), info.getPassword(), info.getDbType().ordinal(), databaseName));
433  }
434 
446  static CaseDbHandle openCaseDb(String path) throws TskCoreException {
447  return new CaseDbHandle(openCaseDbNat(path));
448  }
449 
462  static CaseDbHandle openCaseDb(String databaseName, CaseDbConnectionInfo info) throws TskCoreException {
463  return new CaseDbHandle(openCaseDbMultiNat(info.getHost(), info.getPort(), info.getUserName(), info.getPassword(), info.getDbType().ordinal(), databaseName));
464  }
465 
471  public static String getVersion() {
472  return getVersionNat();
473  }
474 
478  public static void startVerboseLogging(String logPath) {
479  startVerboseLoggingNat(logPath);
480  }
481 
492  public static long openImage(String[] imageFiles) throws TskCoreException {
493  return openImage(imageFiles, true);
494  }
495 
511  private static long openImage(String[] imageFiles, boolean useCache) throws TskCoreException {
512 
513  long imageHandle;
514 
515  StringBuilder keyBuilder = new StringBuilder();
516  for (int i = 0; i < imageFiles.length; ++i) {
517  keyBuilder.append(imageFiles[i]);
518  }
519  final String imageKey = keyBuilder.toString();
520 
521  synchronized (HandleCache.cacheLock) {
522  // If we're getting a fresh copy, remove any existing cache references
523  if (!useCache && HandleCache.imageHandleCache.containsKey(imageKey)) {
524  long tempImageHandle = HandleCache.imageHandleCache.get(imageKey);
525  HandleCache.fsHandleCache.remove(tempImageHandle);
526  HandleCache.imageHandleCache.remove(imageKey);
527  }
528 
529  if (useCache && HandleCache.imageHandleCache.containsKey(imageKey)) //get from cache
530  {
531  imageHandle = HandleCache.imageHandleCache.get(imageKey);
532  } else {
533  //open new handle and cache it
534  imageHandle = openImgNat(imageFiles, imageFiles.length);
535  HandleCache.fsHandleCache.put(imageHandle, new HashMap<Long, Long>());
536  HandleCache.imageHandleCache.put(imageKey, imageHandle);
537  }
538  }
539  return imageHandle;
540  }
541 
554  public static long openVs(long imgHandle, long vsOffset) throws TskCoreException {
555  return openVsNat(imgHandle, vsOffset);
556  }
557 
558  //get pointers
570  public static long openVsPart(long vsHandle, long volId) throws TskCoreException {
571  //returned long is ptr to vs Handle object in tsk
572  return openVolNat(vsHandle, volId);
573  }
574 
587  public static long openFs(long imgHandle, long fsOffset) throws TskCoreException {
588  long fsHandle;
589  synchronized (HandleCache.cacheLock) {
590  final Map<Long, Long> imgOffSetToFsHandle = HandleCache.fsHandleCache.get(imgHandle);
591  if (imgOffSetToFsHandle.containsKey(fsOffset)) {
592  //return cached
593  fsHandle = imgOffSetToFsHandle.get(fsOffset);
594  } else {
595  fsHandle = openFsNat(imgHandle, fsOffset);
596  //cache it
597  imgOffSetToFsHandle.put(fsOffset, fsHandle);
598  }
599  }
600  return fsHandle;
601  }
602 
616  public static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId) throws TskCoreException {
617  /*
618  * NOTE: previously attrId used to be stored in AbstractFile as (signed)
619  * short even though it is stored as uint16 in TSK. In extremely rare
620  * occurrences attrId can be larger than what a signed short can hold
621  * (2^15). Changes were made to AbstractFile to store attrId as integer.
622  * However, a depricated method still exists in AbstractFile to get
623  * attrId as short. In that method we convert attribute ids that are
624  * larger than 32K to a negative number. Therefore if encountered, we
625  * need to convert negative attribute id to uint16 which is what TSK is
626  * using to store attribute id.
627  */
628  long fileHandle = openFileNat(fsHandle, fileId, attrType.getValue(), convertSignedToUnsigned(attrId));
629  HandleCache.addFileHandle(fileHandle, fsHandle);
630  return fileHandle;
631  }
632 
640  private static int convertSignedToUnsigned(int val) {
641  if (val >= 0) {
642  return val;
643  }
644 
645  return val & 0xffff; // convert negative value to positive value
646  }
647 
648  //do reads
663  public static int readImg(long imgHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
664  //returned byte[] is the data buffer
665  return readImgNat(imgHandle, readBuffer, offset, len);
666  }
667 
682  public static int readVs(long vsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
683  return readVsNat(vsHandle, readBuffer, offset, len);
684  }
685 
700  public static int readVsPart(long volHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
701  //returned byte[] is the data buffer
702  return readVolNat(volHandle, readBuffer, offset, len);
703  }
704 
719  public static int readFs(long fsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
720  //returned byte[] is the data buffer
721  return readFsNat(fsHandle, readBuffer, offset, len);
722  }
723 
728  private enum TSK_FS_FILE_READ_OFFSET_TYPE_ENUM {
729  START_OF_FILE(0),
730  START_OF_SLACK(1);
731 
732  private final int val;
733 
734  TSK_FS_FILE_READ_OFFSET_TYPE_ENUM(int val) {
735  this.val = val;
736  }
737 
738  int getValue() {
739  return val;
740  }
741  }
742 
757  public static int readFile(long fileHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
758  if (!HandleCache.isValidFileHandle(fileHandle)) {
759  throw new TskCoreException(HandleCache.INVALID_FILE_HANDLE);
760  }
761 
762  return readFileNat(fileHandle, readBuffer, offset, TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_FILE.getValue(), len);
763  }
764 
779  public static int readFileSlack(long fileHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
780  if (!HandleCache.isValidFileHandle(fileHandle)) {
781  throw new TskCoreException(HandleCache.INVALID_FILE_HANDLE);
782  }
783 
784  return readFileNat(fileHandle, readBuffer, offset, TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_SLACK.getValue(), len);
785  }
786 
797  public static List<String> getFileMetaDataText(long fileHandle) throws TskCoreException {
798  if (!HandleCache.isValidFileHandle(fileHandle)) {
799  throw new TskCoreException(HandleCache.INVALID_FILE_HANDLE);
800  }
801 
802  try {
803  java.io.File tmp = java.io.File.createTempFile("tsk", ".txt");
804 
805  saveFileMetaDataTextNat(fileHandle, tmp.getAbsolutePath());
806 
807  FileReader fr = new FileReader(tmp.getAbsolutePath());
808  BufferedReader textReader = new BufferedReader(fr);
809 
810  List<String> lines = new ArrayList<String>();
811  while (true) {
812  String line = textReader.readLine();
813  if (line == null) {
814  break;
815  }
816  lines.add(line);
817  }
818  textReader.close();
819  fr.close();
820  tmp.delete();
821  return lines;
822  } catch (IOException ex) {
823  throw new TskCoreException("Error reading istat output: " + ex.getLocalizedMessage());
824  }
825  }
826 
827  //free pointers
834  public static void closeImg(long imgHandle) {
835  //@@@ TODO close the image handle when Case is closed instead
836  //currently the image handle is not being freed, it's cached for duration of the application
837  //closeImgNat(imgHandle);
838  }
839 
845  public static void closeVs(long vsHandle) {
846  closeVsNat(vsHandle);
847  }
848 
855  public static void closeFs(long fsHandle) {
856  //@@@ TODO close the fs handle when Case is closed instead
857  //currently the fs handle is not being freed, it's cached for duration of the application
858  //closeFsNat(fsHandle);
859  }
860 
866  public static void closeFile(long fileHandle) {
867  if (!HandleCache.isValidFileHandle(fileHandle)) {
868  // File handle is not open so this is a no-op.
869  return;
870  }
871  closeFileNat(fileHandle);
872  HandleCache.removeFileHandle(fileHandle);
873  }
874 
882  public static void createLookupIndexForHashDatabase(int dbHandle) throws TskCoreException {
883  hashDbCreateIndexNat(dbHandle);
884  }
885 
895  public static boolean hashDatabaseHasLookupIndex(int dbHandle) throws TskCoreException {
896  return hashDbIndexExistsNat(dbHandle);
897  }
898 
909  public static boolean hashDatabaseCanBeReindexed(int dbHandle) throws TskCoreException {
910  return hashDbIsReindexableNat(dbHandle);
911  }
912 
922  public static String getHashDatabasePath(int dbHandle) throws TskCoreException {
923  return hashDbPathNat(dbHandle);
924  }
925 
935  public static String getHashDatabaseIndexPath(int dbHandle) throws TskCoreException {
936  return hashDbIndexPathNat(dbHandle);
937  }
938 
939  public static int openHashDatabase(String path) throws TskCoreException {
940  return hashDbOpenNat(path);
941  }
942 
952  public static int createHashDatabase(String path) throws TskCoreException {
953  return hashDbNewNat(path);
954  }
955 
962  public static void closeAllHashDatabases() throws TskCoreException {
963  hashDbCloseAll();
964  }
965 
973  public static void closeHashDatabase(int dbHandle) throws TskCoreException {
974  hashDbClose(dbHandle);
975  }
976 
984  public static String getHashDatabaseDisplayName(int dbHandle) throws TskCoreException {
985  return hashDbGetDisplayName(dbHandle);
986  }
987 
998  public static boolean lookupInHashDatabase(String hash, int dbHandle) throws TskCoreException {
999  return hashDbLookup(hash, dbHandle);
1000  }
1001 
1013  public static HashHitInfo lookupInHashDatabaseVerbose(String hash, int dbHandle) throws TskCoreException {
1014  return hashDbLookupVerbose(hash, dbHandle);
1015  }
1016 
1029  public static void addToHashDatabase(String filename, String md5, String sha1, String sha256, String comment, int dbHandle) throws TskCoreException {
1030  hashDbAddEntryNat(filename, md5, sha1, sha256, comment, dbHandle);
1031  }
1032 
1033  public static void addToHashDatabase(List<HashEntry> hashes, int dbHandle) throws TskCoreException {
1034  hashDbBeginTransactionNat(dbHandle);
1035  try {
1036  for (HashEntry entry : hashes) {
1037  hashDbAddEntryNat(entry.getFileName(), entry.getMd5Hash(), entry.getSha1Hash(), entry.getSha256Hash(), entry.getComment(), dbHandle);
1038  }
1039  hashDbCommitTransactionNat(dbHandle);
1040  } catch (TskCoreException ex) {
1041  try {
1042  hashDbRollbackTransactionNat(dbHandle);
1043  } catch (TskCoreException ex2) {
1044  ex2.initCause(ex);
1045  throw ex2;
1046  }
1047  throw ex;
1048  }
1049  }
1050 
1051  public static boolean isUpdateableHashDatabase(int dbHandle) throws TskCoreException {
1052  return hashDbIsUpdateableNat(dbHandle);
1053  }
1054 
1055  public static boolean hashDatabaseIsIndexOnly(int dbHandle) throws TskCoreException {
1056  return hashDbIsIdxOnlyNat(dbHandle);
1057  }
1058 
1068  private static String timezoneLongToShort(String timezoneLongForm) {
1069  if (timezoneLongForm == null || timezoneLongForm.isEmpty()) {
1070  return "";
1071  }
1072 
1073  String timezoneShortForm;
1074  TimeZone zone = TimeZone.getTimeZone(timezoneLongForm);
1075  int offset = zone.getRawOffset() / 1000;
1076  int hour = offset / 3600;
1077  int min = (offset % 3600) / 60;
1078  DateFormat dfm = new SimpleDateFormat("z");
1079  dfm.setTimeZone(zone);
1080  boolean hasDaylight = zone.useDaylightTime();
1081  String first = dfm.format(new GregorianCalendar(2010, 1, 1).getTime()).substring(0, 3); // make it only 3 letters code
1082  String second = dfm.format(new GregorianCalendar(2011, 6, 6).getTime()).substring(0, 3); // make it only 3 letters code
1083  int mid = hour * -1;
1084  timezoneShortForm = first + Integer.toString(mid);
1085  if (min != 0) {
1086  timezoneShortForm = timezoneShortForm + ":" + (min < 10 ? "0" : "") + Integer.toString(min);
1087  }
1088  if (hasDaylight) {
1089  timezoneShortForm += second;
1090  }
1091  return timezoneShortForm;
1092  }
1093 
1102  public static int finishImageWriter(long imgHandle) throws TskCoreException {
1103  return finishImageWriterNat(imgHandle);
1104  }
1105 
1113  public static int getFinishImageProgress(long imgHandle) {
1114  return getFinishImageProgressNat(imgHandle);
1115  }
1116 
1122  public static void cancelFinishImage(long imgHandle) {
1123  cancelFinishImageNat(imgHandle);
1124  }
1125 
1137  public static long findDeviceSize(String devPath) throws TskCoreException {
1138  return findDeviceSizeNat(devPath);
1139  }
1140 
1141  public static boolean isImageSupported(String imagePath) {
1142  return isImageSupportedNat(imagePath);
1143  }
1144 
1145  private static native String getVersionNat();
1146 
1147  private static native void startVerboseLoggingNat(String logPath);
1148 
1149  private static native long newCaseDbNat(String dbPath) throws TskCoreException;
1150 
1151  private static native long newCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password, int dbTypeOrdinal, String databaseName);
1152 
1153  private static native long openCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password, int dbTypeOrdinal, String databaseName);
1154 
1155  private static native long openCaseDbNat(String path) throws TskCoreException;
1156 
1157  private static native void closeCaseDbNat(long db) throws TskCoreException;
1158 
1159  private static native int hashDbOpenNat(String hashDbPath) throws TskCoreException;
1160 
1161  private static native int hashDbNewNat(String hashDbPath) throws TskCoreException;
1162 
1163  private static native int hashDbBeginTransactionNat(int dbHandle) throws TskCoreException;
1164 
1165  private static native int hashDbCommitTransactionNat(int dbHandle) throws TskCoreException;
1166 
1167  private static native int hashDbRollbackTransactionNat(int dbHandle) throws TskCoreException;
1168 
1169  private static native int hashDbAddEntryNat(String filename, String hashMd5, String hashSha1, String hashSha256, String comment, int dbHandle) throws TskCoreException;
1170 
1171  private static native boolean hashDbIsUpdateableNat(int dbHandle);
1172 
1173  private static native boolean hashDbIsReindexableNat(int dbHandle);
1174 
1175  private static native String hashDbPathNat(int dbHandle);
1176 
1177  private static native String hashDbIndexPathNat(int dbHandle);
1178 
1179  private static native String hashDbGetDisplayName(int dbHandle) throws TskCoreException;
1180 
1181  private static native void hashDbCloseAll() throws TskCoreException;
1182 
1183  private static native void hashDbClose(int dbHandle) throws TskCoreException;
1184 
1185  private static native void hashDbCreateIndexNat(int dbHandle) throws TskCoreException;
1186 
1187  private static native boolean hashDbIndexExistsNat(int dbHandle) throws TskCoreException;
1188 
1189  private static native boolean hashDbIsIdxOnlyNat(int dbHandle) throws TskCoreException;
1190 
1191  private static native boolean hashDbLookup(String hash, int dbHandle) throws TskCoreException;
1192 
1193  private static native HashHitInfo hashDbLookupVerbose(String hash, int dbHandle) throws TskCoreException;
1194 
1195  private static native long initAddImgNat(long db, String timezone, boolean addUnallocSpace, boolean skipFatFsOrphans) throws TskCoreException;
1196 
1197  private static native long initializeAddImgNat(long db, String timezone, boolean addFileSystems, boolean addUnallocSpace, boolean skipFatFsOrphans) throws TskCoreException;
1198 
1199  private static native void runOpenAndAddImgNat(long process, String deviceId, String[] imgPath, int splits, String timezone) throws TskCoreException, TskDataException;
1200 
1201  private static native void runAddImgNat(long process, String deviceId, long a_img_info, String timeZone, String imageWriterPath) throws TskCoreException, TskDataException;
1202 
1203  private static native void stopAddImgNat(long process) throws TskCoreException;
1204 
1205  private static native void revertAddImgNat(long process) throws TskCoreException;
1206 
1207  private static native long commitAddImgNat(long process) throws TskCoreException;
1208 
1209  private static native long openImgNat(String[] imgPath, int splits) throws TskCoreException;
1210 
1211  private static native long openVsNat(long imgHandle, long vsOffset) throws TskCoreException;
1212 
1213  private static native long openVolNat(long vsHandle, long volId) throws TskCoreException;
1214 
1215  private static native long openFsNat(long imgHandle, long fsId) throws TskCoreException;
1216 
1217  private static native long openFileNat(long fsHandle, long fileId, int attrType, int attrId) throws TskCoreException;
1218 
1219  private static native int readImgNat(long imgHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;
1220 
1221  private static native int readVsNat(long vsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;
1222 
1223  private static native int readVolNat(long volHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;
1224 
1225  private static native int readFsNat(long fsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;
1226 
1227  private static native int readFileNat(long fileHandle, byte[] readBuffer, long offset, int offset_type, long len) throws TskCoreException;
1228 
1229  private static native int saveFileMetaDataTextNat(long fileHandle, String fileName) throws TskCoreException;
1230 
1231  private static native void closeImgNat(long imgHandle);
1232 
1233  private static native void closeVsNat(long vsHandle);
1234 
1235  private static native void closeFsNat(long fsHandle);
1236 
1237  private static native void closeFileNat(long fileHandle);
1238 
1239  private static native long findDeviceSizeNat(String devicePath) throws TskCoreException;
1240 
1241  private static native String getCurDirNat(long process);
1242 
1243  private static native boolean isImageSupportedNat(String imagePath);
1244 
1245  private static native int finishImageWriterNat(long a_img_info);
1246 
1247  private static native int getFinishImageProgressNat(long a_img_info);
1248 
1249  private static native void cancelFinishImageNat(long a_img_info);
1250 
1251 }
static int readImg(long imgHandle, byte[] readBuffer, long offset, long len)
static String getHashDatabaseIndexPath(int dbHandle)
static int readVs(long vsHandle, byte[] readBuffer, long offset, long len)
static void createLookupIndexForHashDatabase(int dbHandle)
static void addToHashDatabase(String filename, String md5, String sha1, String sha256, String comment, int dbHandle)
static int createHashDatabase(String path)
static void closeFs(long fsHandle)
static void cancelFinishImage(long imgHandle)
static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId)
void run(String deviceId, String[] imageFilePaths)
static int readFile(long fileHandle, byte[] readBuffer, long offset, long len)
static int finishImageWriter(long imgHandle)
static HashHitInfo lookupInHashDatabaseVerbose(String hash, int dbHandle)
static long openVs(long imgHandle, long vsOffset)
static boolean hashDatabaseIsIndexOnly(int dbHandle)
static boolean isImageSupported(String imagePath)
static int readVsPart(long volHandle, byte[] readBuffer, long offset, long len)
static void closeVs(long vsHandle)
static long openImage(String[] imageFiles)
Definition: HashEntry.java:25
static long findDeviceSize(String devPath)
static String getHashDatabaseDisplayName(int dbHandle)
static List< String > getFileMetaDataText(long fileHandle)
static void closeImg(long imgHandle)
static long openFs(long imgHandle, long fsOffset)
static int getFinishImageProgress(long imgHandle)
static int openHashDatabase(String path)
static void closeFile(long fileHandle)
static boolean lookupInHashDatabase(String hash, int dbHandle)
static boolean hashDatabaseHasLookupIndex(int dbHandle)
static long openVsPart(long vsHandle, long volId)
static int readFileSlack(long fileHandle, byte[] readBuffer, long offset, long len)
static boolean isUpdateableHashDatabase(int dbHandle)
static void addToHashDatabase(List< HashEntry > hashes, int dbHandle)
static boolean hashDatabaseCanBeReindexed(int dbHandle)
static void startVerboseLogging(String logPath)
static int readFs(long fsHandle, byte[] readBuffer, long offset, long len)
static String getHashDatabasePath(int dbHandle)
static void closeHashDatabase(int dbHandle)

Copyright © 2011-2018 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.